{"schema":"vulnpedia.research/1","cve":"CVE-2023-22894","references":[{"url":"https://github.com/strapi/strapi/releases","tags":["x_transferred","Release Notes","WEB"],"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","url":"https://github.com/strapi/strapi/releases"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-02T10:20:31.183Z","url":"https://github.com/strapi/strapi/releases"},{"source":"nvd","sourceId":"CVE-2023-22894","modified":"2026-10-09T14:20:41.113","url":"https://github.com/strapi/strapi/releases"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://github.com/strapi/strapi/releases"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://github.com/strapi/strapi/releases"}]},{"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/","tags":["x_transferred","Exploit","Third Party Advisory"],"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-02T10:20:31.183Z","url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/"},{"source":"nvd","sourceId":"CVE-2023-22894","modified":"2026-10-09T14:20:41.113","url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/"}]},{"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","tags":["x_transferred","Exploit","Vendor Advisory","WEB"],"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","origins":[{"source":"mitre","sourceId":"mitre","modified":"2023-04-19T00:00:00.000Z","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-02T10:20:31.183Z","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"},{"source":"nvd","sourceId":"CVE-2023-22894","modified":"2026-10-09T14:20:41.113","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-09T03:55:26.444Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-09T03:55:26.444Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894"},{"source":"nvd","sourceId":"CVE-2023-22894","modified":"2026-10-09T14:20:41.113","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894"}]},{"url":"https://osv.dev/vulnerability/GHSA-jjqf-j4w7-92w8","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://osv.dev/vulnerability/GHSA-jjqf-j4w7-92w8"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://osv.dev/vulnerability/GHSA-jjqf-j4w7-92w8"}]},{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22894","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22894"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22894"}]},{"url":"https://github.com/strapi/strapi","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://github.com/strapi/strapi"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://github.com/strapi/strapi"}]},{"url":"https://github.com/strapi/strapi/releases/tag/v4.8.0","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://github.com/strapi/strapi/releases/tag/v4.8.0"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://github.com/strapi/strapi/releases/tag/v4.8.0"}]},{"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://www.ghostccamm.com/blog/multi_strapi_vulns"},{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://www.ghostccamm.com/blog/multi_strapi_vulns"}]},{"source":"euvd","sourceId":"EUVD-2023-1342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1342","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2023-1342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1342"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://vulncheck.com/xdb/6dfa9c56d986","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"6dfa9c56d986","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6dfa9c56d986","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/xdb/6dfa9c56d986"}]},{"url":"https://github.com/Saboor-Hakimi/CVE-2023-22894","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"6dfa9c56d986","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6dfa9c56d986","modified":"2026-10-08T00:00:00Z","url":"https://github.com/Saboor-Hakimi/CVE-2023-22894"}]},{"url":"https://vulncheck.com/xdb/67ac3833c602","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"67ac3833c602","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"67ac3833c602","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/xdb/67ac3833c602"}]},{"url":"https://github.com/maxntv/CVE-2023-22894-PoC","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"67ac3833c602","modified":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"67ac3833c602","modified":"2026-10-08T00:00:00Z","url":"https://github.com/maxntv/CVE-2023-22894-PoC"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","url":"https://osv.dev/vulnerability/GHSA-jjqf-j4w7-92w8","ecosystem":"npm","name":"@strapi/strapi","purl":"pkg:npm/%40strapi/strapi","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.1"},{"fixed":"4.8.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-jjqf-j4w7-92w8/GHSA-jjqf-j4w7-92w8.json"},"modified":"2023-11-08T04:11:39.345435Z","origins":[{"source":"ghsa","sourceId":"GHSA-jjqf-j4w7-92w8","modified":"2023-11-08T04:11:39.345435Z","url":"https://osv.dev/vulnerability/GHSA-jjqf-j4w7-92w8"}]}],"pocCandidates":[{"url":"https://github.com/Saboor-Hakimi/CVE-2023-22894","source":"poc-in-github","sourceId":"CVE-2023-22894","description":"CVE-2023-22894","modified":"2025-10-22T04:47:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2023-22894","url":"https://github.com/Saboor-Hakimi/CVE-2023-22894"},{"source":"poc-in-github","sourceId":"CVE-2023-22894","modified":"2025-10-22T04:47:41Z","url":"https://github.com/Saboor-Hakimi/CVE-2023-22894"}],"tags":[]},{"url":"https://github.com/maxntv/CVE-2023-22894-PoC","source":"poc-in-github","sourceId":"CVE-2023-22894","modified":"2025-07-31T16:17:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2023-22894","url":"https://github.com/maxntv/CVE-2023-22894-PoC"},{"source":"poc-in-github","sourceId":"CVE-2023-22894","modified":"2025-07-31T16:17:10Z","url":"https://github.com/maxntv/CVE-2023-22894-PoC"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"6dfa9c56d986","url":"https://vulncheck.com/xdb/6dfa9c56d986","cve":"CVE-2023-22894","dateAdded":"2023-12-20T23:26:13Z","modified":"2026-10-08T00:00:00Z","exploitType":"infoleak","repositoryUrl":"https://github.com/Saboor-Hakimi/CVE-2023-22894","observations":[{"dateAdded":"2023-12-20T23:26:13Z","exploitType":"infoleak"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"6dfa9c56d986","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/xdb/6dfa9c56d986"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"67ac3833c602","url":"https://vulncheck.com/xdb/67ac3833c602","cve":"CVE-2023-22894","dateAdded":"2026-10-12T20:02:12Z","modified":"2026-10-08T00:00:00Z","exploitType":"info-leak","repositoryUrl":"https://github.com/maxntv/CVE-2023-22894-PoC","observations":[{"dateAdded":"2026-10-12T20:02:12Z","exploitType":"info-leak"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"67ac3833c602","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/xdb/67ac3833c602"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-10-08T00:00:00Z","modified":"2026-10-08T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Strapi","product":"Strapi","dueDate":"2026-10-11T00:00:00Z","cisaDateAdded":"2026-10-08T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","modified":"2026-10-08T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","dateAdded":"2026-10-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a"},{"source":"vulncheck-kev","sourceId":"CVE-2023-22894","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]}]}